[jbailey4]

Summary

Harness Runtime Environments (configs) and YAML-backed session creates need to ask harness-api to mint a DigitalOcean Inference key when the agent will use serverless inference. That opt-in is manage_model_access_key (config create JSON body field; session create query param).

This change makes doctl set that flag implicitly from the resolved manifest, not from harness/adapter name:

1. HARNESS_INFERENCE_MODEL is set (non-empty)
2. no non-empty HARNESS_INFERENCE_API_KEY
3. no non-empty OPENAI_API_KEY or ANTHROPIC_API_KEY

If any of those vendor/harness keys are present (including via --secret), doctl does not send the opt-in. --from-config / config start-session are unchanged: the Environment already fixed the key decision at create time.

What changed

• Shared needsManagedModelAccessKey predicate used by session create and config create
• Session create no longer hard-codes openhands/hermes adapter checks
• CreateAgentConfig accepts a manage-key bool and, when true, POSTs a hand-built body including manage_model_access_key: true
• Help text for create / config create documents the behavior

Why not godo for that config create path

Vendored godo’s HostedAgentConfigCreateRequest only has name + manifest_yaml — no manage_model_access_key field yet. Sending an unknown field isn’t an option via the typed struct, so when the opt-in is needed we build the JSON and call /v2/harness-runtime/configs through the godo client’s request/Do path (same pattern as CreateSessionFromManifestWithManagedKey, and similar to other doctl bypasses when godo lags, e.g. domains record port encoding / Functions namespaces). When the flag is false we still use the normal godo CreateAgentConfig call.

Test plan

Automated

• Unit tests for the predicate (model-only, BYOK harness key, empty slot, OpenAI/Anthropic, legacy envelope, unresolved placeholders)
• do/ wire tests that config create with manage-key sends "manage_model_access_key":true and omits it when false
• Command tests for config create and session create positive/negative cases (including hermes + OPENAI_API_KEY skipping managed key)
• make build, gofmt_check, shellcheck, check_focused
• Feature-focused go test for ManagedKey / AgentConfigCreate / Hermes / OpenHands
• Harness-runtime integration suites (balance / pause-reason)

Live (ui-open-harness-team, ./builds/doctl)

• Matrix of config create and session create across harnesses (openhands, hermes, opencode+--model, claude-code, codex) × providers (DO SI / BYOK HARNESS_INFERENCE_API_KEY / OpenAI / Anthropic)
• Verified via config get -o json: credentials / manifest.secrets include HARNESS_INFERENCE_API_KEY when expected, and omit it for vendor-key cases
• Spot-checked vendor configs still carry OPENAI_API_KEY / ANTHROPIC_API_KEY
• create --from-config on a DO-SI Environment inherits the minted key slot
• Cleaned up mak-* sessions/configs afterward